By John Cox
May 20, 2019, © Leeham News: The latest version of the Boeing 737 is the MAX. It has new engines, new flight deck screens and the latest in-flight entertainment systems for passengers. It is quite a change from the 737-100 that first entered service 51 years earlier in 1968.
After flying operationally for 15 months (May 2017 to October 2018), there was a loss of a 737 MAX 8 in Indonesia. Five months later, another MAX 8 crashed. Something was wrong. How could such a proven workhorse have two accidents in such a short time in very similar circumstances?
Investigators swarmed over the wreckage finding the recorders. There were similarities in the accidents and some in the media closed in on simple causes for the loss of 346 lives. It is not simple.
As an accident investigator since 1986, one truth remains with me today. It is never simple. Airplanes today are so safe, have so many redundant systems and operate in such complex airspace that the cause of an accident cannot be simple.
Since both the Lion Air 610 and Ethiopian 302 accidents are under investigation, we have to limit our discussion to information that has been publically released. While awaiting the final reports, the aviation industry must take limited data and take steps to ensure that aviation’s safety record remains intact.
The Lion Air accident is one of the most complex in modern history. Investigators found substantive issues contributing to the accident.
First, let us categorize both accidents: They are Loss of Control–Inflight (LOC-I) accidents. This accident type causes more fatalities than any other. Our industry has improved training in an effort to reduce the number of LOC-I accidents, but they continue to occur too frequently.
We have categorized the accident type but it is not that simple; there are contributing factors.
Looking at the available information, aircraft system design, system certification, maintenance, safety information within the operator, pilot actions and training all appear to have contributed.
The Lion Air crew did not know of a system added to the MAX known as the Maneuvering Characteristics Augmentation System (MCAS). It caused the stabilizer to be trimmed nose down without pilot input once the airplane accelerated and retracted the flaps.
This occurred as the stall warning device known as a stick shaker noisily shook the control column, causing confusion in the flight deck. Both were the result of erroneous data about the angle of attack (the angle between the wing and the air passing over it). The pilots now faced multiple faults from an unknown cause and the situation was getting worse.
As the airplane struggled to climb, the airspeed increased. The airspeed increase caused the stabilizer to be more and more powerful compared to the elevator. The elevator is what moves when the pilot moves the control column while the stabilizer is moved by an electric motor in trim system. As each second ticked by, the airplane accelerated, making it harder to control.
Why did MCAS trim the nose down? The central design goal of the MAX design was to improve fuel efficiency. New engines could do that, but required bigger initial compressor sections, known as a fan. This required the engine to be move forward and raised to keep the necessary ground clearance while taxiing.
One consequence was the reduction in the nose pitching down during lightweight stalls with the airplane loaded as far aft as allowed. The FAA and engineers found it needed help the nose pitch down during these conditions. MCAS was the solution.
MCAS only took in information from one sensor. It did not evaluate if the data was similar to the other sensor on the opposite side of the airplane. Consequently, if the sensor data were erroneous, MCAS would activate even though there was no stall.
Erroneous data would also cause another stall prevention device to violently shake the control column. A system safety analysis should have shown that these two stall prevention systems could be caused by a single failure of Angle of Attack (AoA) data.
If MCAS activated inappropriately, could the pilots stop it? Yes, they could disable the stabilizer trim motor with switches. This makes the assumption that they realize what is happening and follow the procedure for a “Runaway Stabilizer Trim.” But is not that simple.
In the MAX, the stabilizer moves frequently without pilot input due to another system known as the Speed Trim System (STS). STS moves the stabilizer during acceleration or deceleration to maintain the proper feel in the control column.
The pilots of Lion Air 610 faced a challenge: the stabilizer trim was moving as the control column was getting heaver due to the acceleration. Was this a “runaway trim” or STS? Did they realize the trim was moving with the noise of the stick shaker masking it?
On the previous flight with a different crew, similar events occurred, but that crew had and additional set of eyes in the flight deck. A pilot on his way to work, riding in the jumpseat, saw the trim moving as the crew fought for control. He alerted the captain and the trim system was manually disabled. They made a safe landing.
This should have alerted the accident crew of a potential problem.
It is not that simple.
The safety report never reached the accident crew.
Lion Air maintenance had been working on problems for the three days prior to the accident. Instrument warnings were occurring flight after flight. The simple solutions were not fixing the problems. Maybe a sensor was the cause.
With that hypothesis, they changed the sensor, even though it was not definitely the cause of the problems. Even with the new sensor, the problems continued. It was more complicated.
Now, investigators have contributing factors of design, certification, crew action, maintenance trouble-shooting, failure to remove an airplane with recurring problems from service, failure to provide crews with critical information of problems encountered on a previous flight, and the addition of a system that could trim the stabilizer without pilot input without informing the operators.
There is nothing simple about this accident.
Ethiopian Airlines flight 302 faced similar challenges, but there were no maintenance problems and the crew knew about MCAS. It is a bit simpler, but still a very complex accident.
Investigators will finish their reports in upcoming months. Regulators will very carefully review the system improvements to the MAX before it return to the air. Pilots will be trained about the flight control system, including MCAS. Maintenance technicians will review trouble-shooting airplanes with recurring flight control problems.
The 737 MAX will soon return to flying passengers around the world. The tragedies will not be forgotten and the lessons will be remembered.
Our robust aviation safety system must carefully review new designs for latent single point failures that can cause multiple, complex problems. Pilots should be trained about new additional systems added to new models and how malfunctions are to be handled. Additionally, pilots must train to fly manually when automated systems become inoperative and maintain the proper airspeed. Operators must carefully monitor aircraft experiencing recurring technical problems and remove them from service.
We will fly over 4.5bn passengers this year. The two 737 MAX accidents remind us of the importance of ensuring the safety of each passenger. We have built the safest public transportation system in history, and it will continue to improve.
We will do what it takes to ensure it does, but it will not be simple.
John Cox has a 49 year career in aviation with over 25 in commercial aviation, including as an airline pilot, instructor and test pilot. He has type ratings in the Cessna Citation, Fokker F-28, Boeing 737, and Airbus A320 He has been an independent air safety consultant since 2005.